{"record":{"id":"ee8df444c89487be","repo":"apache/cassandra","slug":"unsupported-client-auth","errorCode":null,"errorMessage":"Unsupported client auth ","messagePattern":"Unsupported client auth ","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/AbstractSslContextFactory.java","lineNumber":306,"sourceCode":"     * Create a {@code KeyManagerFactory} for outbound connections.\n     * It provides a seperate keystore for internode mTLS outbound connections.\n     * @return {@code KeyManagerFactory}\n     * @throws SSLException\n     */\n    abstract protected KeyManagerFactory buildOutboundKeyManagerFactory() throws SSLException;\n\n    private ClientAuth toNettyClientAuth(EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth)\n    {\n        switch (clientAuth)\n        {\n            case REQUIRED:\n                return ClientAuth.REQUIRE;\n            case NOT_REQUIRED:\n                return ClientAuth.NONE;\n            case OPTIONAL:\n                return ClientAuth.OPTIONAL;\n            default:\n                throw new RuntimeException(\"Unsupported client auth \" + clientAuth);\n        }\n    }\n}\n","sourceCodeStart":288,"sourceCodeEnd":310,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/AbstractSslContextFactory.java#L288-L310","documentation":"toNettyClientAuth maps the configured require_client_auth enum (ClientAuth enum) to Netty's ClientAuth mode. The default branch throws if the enum value is unrecognized, which in practice can only happen with an unexpected null or a future/foreign enum constant. It is an internal exhaustiveness guard.","triggerScenarios":"createNettySslContext calls toNettyClientAuth with a ClientAuth value not covered by REQUIRE/NOT_REQUIRED/OPTIONAL — effectively only null or an unknown constant.","commonSituations":"Programming errors after adding a new ClientAuth enum constant without updating this switch, or reflection/serialization code injecting a bogus value.","solutions":["Check the require_client_auth value configured; use only true/false (mapped to REQUIRE/NOT_REQUIRED).","If a new ClientAuth constant was added to the codebase, add a corresponding case to the switch in toNettyClientAuth.","Ensure callers never pass null; default require_client_auth explicitly in config parsing."],"exampleFix":"// before\nswitch (clientAuth) { case REQUIRE: return ClientAuth.REQUIRE; ... default: throw new RuntimeException(\"Unsupported client auth \" + clientAuth); }\n// after\nswitch (clientAuth) { case REQUIRE: return ClientAuth.REQUIRE; case NOT_REQUIRED: return ClientAuth.NONE; case OPTIONAL: return ClientAuth.OPTIONAL; case NEW_MODE: return ClientAuth.OPTIONAL; default: throw new RuntimeException(\"Unsupported client auth \" + clientAuth); }","handlingStrategy":"type-guard","validationCode":"if (clientAuth != ClientAuth.REQUIRE && clientAuth != ClientAuth.NOT_REQUIRED && clientAuth != ClientAuth.OPTIONAL)\n    throw new IllegalArgumentException(\"Unsupported client auth: \" + clientAuth);","typeGuard":"boolean isKnownClientAuth(ClientAuth a) { return a != null && EnumSet.of(ClientAuth.REQUIRE, ClientAuth.NOT_REQUIRED, ClientAuth.OPTIONAL).contains(a); }","tryCatchPattern":"try { ClientAuth netty = toNettyClientAuth(clientAuth); } catch (RuntimeException e) { /* map to config error, fail fast at startup */ }","preventionTips":["Exhaustive switch with default throw and IDE checks when adding enum constants","Never pass null ClientAuth; normalize config values at parse time"],"tags":["ssl","enum","internal"],"backgroundTag":"unsupported-enum-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}